I ran into an issue where IIS wouldn't start on a Windows server due to the port binding (port 80) already being used. In looking at event viewer, the service was showing in the System log to not be starting due to a "file in use" which typically means port in use. So just doing a bit of netstat work, I looked at the netstat output for port 80.
Using the command below:
netstat -ano | findstr :80
So I had this output showing the autoprivate IP with port 80 bound. But key in the above is that we see the PID which is 2856. What service is using this? To find out I used the command:
tasklist | findstr 2856
Then to find the actual service using it, run the command:
tasklist /svc | findstr 2856
The above shows the iplpsvc or "IP helper service" that sometimes binds to port 80. Sure enough, I stopped this service and IIS started without issues. Hopefully this will help show the steps to quickly find the service that may have a port bound.